@funny-booth/agent-core@0.1.15
古い版です。最新版を使ってください
AIエージェント起動CLI（共有ランチャー + MCPサーバー）
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no automatic consumer-install hook, so the source does not establish malicious installation-time behavior. However, opaque portal-controlled command execution and an unprompted global updater are concrete high-risk capabilities that warrant a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Invoke the launcher, or invoke its MCP install operation after authentication.
Impact
A compromised or malicious portal response can run arbitrary commands with the invoking user's privileges and install a newer package release.
Mechanism
Portal-supplied command execution and silent global self-update.
AI rationale
The package has no automatic consumer-install hook, so the source does not establish malicious installation-time behavior. However, opaque portal-controlled command execution and an unprompted global updater are concrete high-risk capabilities that warrant a warning.
Evidence
dist/index.jsdist/launcher.jslauncher.config.json~/.salesbot/vault.key~/.salesbot/portal-token.enc
Network endpoints1
app.ai-agentos.jp
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Published code is deliberately obfuscated before publishing, preventing meaningful user inspection.
- The MCP install operation sends requested data to the portal and executes a command supplied in the response.
- The launcher silently starts a detached global update to the latest package release when invoked.
- The launcher can fetch bundled MCP definitions and pass portal-provided package and environment data into Claude Code.
Evidence against
- There is no consumer install, preinstall, or postinstall lifecycle hook; prepublishOnly runs only when publishing.
- The command execution path requires an authenticated MCP install request rather than package installation.
- The visible vault implementation stores user-provided secrets locally with encryption and restrictive file permissions.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
4 flagged · loading sourcedist/bin/salesbot7.jsView file
2// AUTO-GENERATED by scripts/generate-bins.mjs — do not edit
L3: require("../launcher.js").runLauncher(7).catch((e) => {
L4: process.stderr.write(String((e && e.stack) || e) + "\n");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/bin/salesbot7.jsView on unpkg · L2dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @funny-booth/agent-core@0.1.8
matchedIdentity = npm:QGZ1bm55LWJvb3RoL2FnZW50LWNvcmU:0.1.8
similarity = 0.857
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: 'use strict';const _0x38467e=_0x5add;(function(_0x2dc70f,_0x69a0a2){const _0x24df6e=_0x5add,_0x3b00e5=_0x2dc70f();while(!![]){try{const _0x23f44a=-parseInt(_0x24df6e(0x24e))/0x1+pa...
Findings
1 Critical3 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighSame File Env Network Executiondist/index.js
HighObfuscated Payload Loaderdist/index.js
HighObfuscated
MediumDynamic Requiredist/bin/salesbot7.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @funny-booth/agent-core@0.1.15.
See all versions of @funny-booth/agent-core for other recorded verdicts.
- Review the evidence and your use of @funny-booth/agent-core@0.1.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.